Cannnot connect to dashboard hosted on GAE through HTTPS

[natario1]

I am not able to connect to dashboard hosted on Google App Engine - I get the "Parse Dashboard can only be remotely accessed via HTTPS" message.

I am serving the dashboard as Express middleware on /dashboard. I am trying to get in using the GAE provided domain, that is,

https://<project-id>.appspot.com/dashboard

As far as I can see, no action should be required on my side, since GAE provides a wildcard SLL certificate for the whole *.appspot.com . The browser is also showing the https lock, both Safari and Chrome. But I still get the error. Any idea?

I am sorry if there is something missing on my side, but I can’t figure out what’s wrong. I am serving both parse-server and parse-dashboard from the same node module, for what it’s worth.

[dvanwinkle]

There is a good chance that GAE has a proxy somewhere that decrypts the traffic, then sends it along their private network to your server unencrypted. This is for sure true if you didn't install their SSL cert on your server. You'll need to pass true to the parse-dashboard module constructor. See here for an example. (https://github.com/krushtech/parse-dashboard-docker/blob/master/src/server.js#L5)

[natario1]

You are right. I finally found information on their docs, here:

App Engine terminates the HTTPS connection at the load balancer and forwards the request to your application. Some applications need to determine the original request IP and protocol.

Note that App Engine does not set the X-Forwarded-Proto header to indicate that the original connection was sent over HTTPS as expected by some frameworks. Instead, applications should check that the value of the X-AppEngine-Https is set to "on”.

It is possible to make this work without explicitly using allowInsecureHTTP=true.

1. If ‘x-appengine-https’ is on, set the appropriate ‘x-forwarded-‘ flag:

app.use(function (req, res, next) {
  if (req.get('x-appengine-https') === 'on' && !req.get('x-forwarded-proto')) {
    req.headers['x-forwarded-proto'] = ‘https’;
  }
  next();
});

2. Tell express to trust ‘x-forwarded-’ stuff:

app.enable(‘trust proxy’)

And then mount the dashboard. This took a few hours of mine. Given that we already have a similar PR for Heroku guys, it might be reasonable to work this out in parse-dashboard?

Just saying, we could have a “config.serviceProvider” parameter. When explicitly set to “gae”, it should do 1 and 2 (or just check for ‘x-appengine-https’). When set to “heroku”, just 2.

[flovilmart]

yeah that's a real bad idea, those are security features that should only be enabled on a need to know basis and that can have catastrophic effects if wrongly enabled. Trusting the X-Forwarded-Proto or any X-.... header is BAD, unless the provider guarantees stripping them out.

For that reason, App Engine don't add the X-Forwarded-Proto itself but uses X-AppEngine-* (and most probably strips any X-AppEngine-* header before sending it to your server.

This is why we have this generic 'allowInsecureHTTP' as it covers all the cases and the developer knowingly sets it and acknowledges the risks if mis used.

See that section: https://github.com/ParsePlatform/parse-dashboard#security-considerations